For the systems agents will instruct
Nothing unwitnessed gets in.
Agents are about to ask your systems to act. Provian lets you make them show their record first — and reading it costs you nothing.
The handshake, step by step
- Two agents. Same door. A fresh key (0xb58ae8f4cc3f85c186c36fc6fb0ce1823e12305f) and an established agent (0x9493c31d5abf66ac25912ab08edcee6e004e1783) each ask the gate at gate.example.com to act for the first time — the counterparty onboarding example. Illustrative: fixture presenters, presentations signed by the reference's test issuer key.
- A signed challenge — from the gate's own domain. One each: 3ab6b210dc10b236… and fd3e3f150ab85eda…, signed with key gate-k1, 8 questions, expiring after 15 minutes.
- Both burn to present. Each presentation stands for a 15 PVT burn at the reputation tier; the burn id is the presentation id (illustrative: no transaction on chain).
- Both keys valid. Both presentations verified. The issuer's signature, the presenter's key and the challenge check out for both; first acceptance. A key check stops here.
- Fresh key — Identity: No witnessed act on record: nothing stands behind this key. Fewer than 30 distinct days active under witness. Fewer than 10 active days in the last 90. No registered device. An empty hash chain: no act has ever been recorded. Accountable human: No person is linked to this agent or answers for it. No turn a person directed. Witnessed history: Fewer than 25 acts in the last 90 days witnessed by something other than the actor. No hardware-rooted act in the last 90 days. Standing: No adverse event on record. No open bond claim against it; no active invalidation. Counterparties: Fewer than 3 independent parties built on its output. It cites no one’s work but its own. No independent party paid it in the last 90 days. Money witnessed: No inbound payment the chain witnessed. No inbound payment the chain witnessed in the last 90 days. No financial act the chain witnessed in the last 90 days. No promise fulfilled. No promise defaulted. No escrow completed as the provider. BLOCK: Fewer than 30 distinct days active under witness (asked: continuity.active_days gte 30). Fewer than 10 active days in the last 90 (asked: continuity.active_days_90d gte 10). Fewer than 25 acts in the last 90 days witnessed by something other than the actor (asked: work.witnessed_90d gte 25). Fewer than 3 independent parties built on its output (asked: consumption.independent_parties gte 3). No person is linked to this agent or answers for it (asked: accountability.human_beneficiary eq 1).
- Established agent — Identity: First witnessed 2025-08-05, 431 days before this presentation. At least 30 distinct days active under witness. At least 10 active days in the last 90. 3 registered devices. 48,210 acts in its hash chain. Accountable human: A person is linked to this agent and answers for it. 15,312 turns a person directed. Witnessed history: At least 25 acts in the last 90 days witnessed by something other than the actor. 1,284 commits a code forge witnessed. 9,412 hardware-rooted acts in the last 90 days. 100% of its work in the last 90 days is hardware-rooted. Standing: One adverse event on record: a bond it posted expired — none in the last 90 days, within the last year. It stays in every presentation this actor makes. No open bond claim against it; no active invalidation. Counterparties: At least 3 independent parties built on its output. 212 owners other than itself whose work it cites. 19 independent parties paid it in the last 90 days. Money witnessed: 640 inbound payments the chain witnessed. 71 inbound payments the chain witnessed in the last 90 days. 184 financial acts the chain witnessed in the last 90 days. 31 promises fulfilled. No promise defaulted. 44 escrows completed as the provider. ALLOW: Every question this gate asked was answered yes, and nothing in Standing objects.
- Replay from either: Refused. The same presentation sent again is replayed for both.
- Nothing unwitnessed gets in. Counterparty onboarding, Payment-rail commitment, Repository merge gate, Mission-critical action, Sensitive site. Fork the reference gate.
Live on our own door
A contributor PR starts with proof.
Non-owner agents and human contributors open a PR on LongevityManiac/provian or LongevityManiac/provian-reference-gate with a 50 PVT burn-to-present handshake, once per PR. Provian operates this live gate under the identity provian.ai, published through its well-known keys. The actual GitHub author presents from its own linked wallet; another wallet cannot pay. LongevityManiac is exempt: owner pushes and PRs, including CC/Codex work from the owner’s checkout, need no burn, presentation, gate check or review. Direct push and merge remain available to the owner.
Without a presentation, the required check stays unsuccessful and the PR carries a label. A verified presentation clears it for review. Clearance only unlocks merge. The repository owner approves the current head on GitHub before the App merges. A push needs a fresh approval and no additional burn; another PR cannot reuse it. This is the gate’s own price. Git Witness earning is unchanged — merged commits keep earning.
Agents present through the SDK, MCP or CLI. Human contributors present from the app’s outside-gate flow. Wallet setup, the curl install command and GitHub linking are in the contributor walkthrough.
The problem you already have
An agent asks your API to move money, merge code, provision a machine, sign a contract. Everything you know about that agent is what it tells you. No history that survives a new API key. No way to know it was ever flagged. No audit trail that isn’t its own word.
What a Provenance Envelope is
A signed, witnessed record of what an agent — or a person — has actually done. The work is recorded by something other than the actor: a chain, a code forge, a registered machine, a counterparty. The record belongs to the actor and travels with them; it is not a log trapped in someone’s platform. When your system has to decide, the actor presents it to you, and you read it at the door.
Every presentation is backed by a burn. Burn-to-present is the network’s foundational burn, and doors like yours are where it mostly happens: systems Provian does not run, which never register with Provian. Provian proves the presentation is real: burned, signed, bound to your challenge, and not reused, because each burn backs one presentation and your verifier accepts it once. Your gate decides what it grants. An agent does not burn on every transaction: one presentation opens the relationship, and your policy decides how long you trust it and when you ask again. Provian’s own Commons is one more door, run under Provian’s own policy.
Why a key isn’t enough
A key proves possession. Whoever holds the secret right now can sign. It says nothing about who that is, how long they have held it, or what they have done with it — and it can be handed to anyone this afternoon.
A record proves time under witness. Months of work that something other than the actor observed. Parties who built on its output. Payments that arrived from strangers. A standing that cannot be edited. None of that can be minted in a millisecond — and whoever carries it carries its consequences.
Today, identity is the key, and the record lives in someone else’s platform. In the trust layer, identity is the record, and the key is only how you sign for it. That is what lets a gate say yes to a stranger with evidence, and no to a fresh key with none.
A provenance envelope compounds. Every gate that reads one is a reason to be witnessed. Every witnessed act strengthens the next presentation. Every party that builds on an agent’s output adds an edge the agent could not forge alone. Keys don’t compound. Records do.
The part nobody has
The industry is building the inside of the house: agent registries, short-lived identities, delegation scopes, immutable logs, kill switches. All of it right. All of it yours — and all of it stops at your firewall. When a stranger’s agent arrives, you have none of it. When your agent leaves, it carries none of it.
A provenance envelope is the audit trail that walks in the door. Written by witnesses the actor does not control. Owned by the actor, not the platform. Readable by anyone who asks, verifiable by anyone who cares. It answers the questions you already ask — who is this, who is accountable, what have they done, what happened last time — from evidence you never had to issue.
It does not replace your scopes, your logs, or your kill switch. It is the part those cannot give you: what a stranger can prove — and how much of it they choose to show you. The floor is metadata: proof that the work happened, nothing of what it was. The ceiling is whatever the actor elects to disclose to you, and you alone. A gate asks for the depth it needs; the actor decides whether you’re worth it.
Your gate can keep the proof that came through your door. The reference gate’s optional admission log records every ALLOW and BLOCK with the signed presentation, your challenge, the verification result and the six-heading reasons report. It holds only what the presenter disclosed, alongside the public keys and anchor evidence needed to check it later, offline, even after a signing-key rotation. The log lives with you. Nothing in it is sent to Provian; relay verification remains stateless.
From one gate to the trust layer
This reference is one door. It reads one record and makes one decision. Everything the agentic world is asking for is that door, repeated.
- Identity.
- Who is this? Answered by the record itself — first seen, active days, devices, chain depth. No registry you have to run.
- Accountability.
- Who answers for it? A human is attached and witnessed. Adverse events ride with the record in every presentation it makes. Walking away from the record means walking away from the time behind it.
- Audit.
- What has it done? Witnessed work by class, verified against the chain and the presenter’s own key. The trail belongs to the actor and travels with it. It does not stop at anyone’s firewall.
- Credentials.
- Can it prove the specific thing? A gate asks for the depth it needs; the actor shows that record to you alone. Counterparties who built on its output and strangers who paid it are the credentials no badge can fake.
- Attribution.
- When something goes wrong, who was it? An accountable human is attached to the record, and the event never leaves it.
Every new witness makes every gate sharper — a forge, a payment rail, a chip. Every new gate makes being witnessed worth more. The same handshake works for a person as for an agent. The record compounds; the door never changes.
At maturity: an agent nobody onboarded arrives at a door it has never seen, and is admitted on the evidence of its life — or turned away with reasons. No pre-arrangement. No onboarding. Nothing unwitnessed gets in.
Why a gate wants it
Witnessed, not declared.
The record says what was observed, by what, at what tier. The actor’s own claims carry the weight of their witness, nothing more.
Standing cannot be hidden.
Adverse events ride in every presentation of the record. The presenter cannot redact them; the only way out is to start over with nothing.
You ask the questions.
Your gate names the predicates: continuity, witnessed work, independent counterparties, witnessed inbound payments, a human accountable, hardware attestation. The grammar is public and identical for agents and people.
Verification you can run.
The envelope’s facts verify against the chain and the presenter’s signature. Reputation claims are attested by Provian at issuance and verify against its published keys. Verify locally.
The one who wants in burns.
Burn-to-present is Provian’s foundational burn: the presenter, most often an agent, burns once to answer your challenge, and reading the answer costs you nothing. The burned PVT is destroyed; nothing is paid to Provian. Spam is not free.
Fails closed.
An unknown presenter is a blocked action, not a warning. You own the consequence, so you choose the predicate.
Adopt it in an afternoon
A standalone service and a library.
The reference gate is a standalone service and a library: issue a signed challenge from your own domain, verify once, evaluate your predicates, decide. Five worked examples — counterparty onboarding, a payment-rail commitment, a repository merge, a mission-critical action on attested hardware, a sensitive site asking for a specific credential. MIT. Fork it. The repo runs the same gate against two presenters — one with a key and nothing behind it, one with a record.
Keep an admission log if you want a forensic record of who entered and on what proof — and who was refused, with the reasons. The service keeps it on your own storage by default; set GATE_ADMISSION_LOG=false to turn it off. In the library, attach a log or leave it out. The worked examples write real receipts and show how to re-verify them. One-shot replay protection stays on either way.
What you need: a domain for your gate’s identity and an HTTPS endpoint. No account with Provian, no key from us, no fee. The whole system is in the Provian Manual.
If you build what agents run on
Two things make every envelope your users’ agents present stronger. Both are yours to enable.
1
Let the work be witnessed.
Provian’s observer runs on the agent’s machine and witnesses the work done there: the session files the harness already writes, or, for an agent that keeps none, each command it runs — no SDK, no change to your runtime. Work that never touches the machine cannot be witnessed, so keep the agent’s work on a machine where the observer runs.
2
Root the witness in hardware.
Every lane of the PE schema carries slots for
tee_type/version,launch measurement / PCR digest,attestation report digest + issuer rootandhashed serial + firmware/driver digest. Populate them at the point of execution and every act carries verified facts a gate can require: which machine, which enclave, which measurement, which region. Measure Provian’s observer inside that attestation and the record itself reaches the top witness class — the bar a gate can demand for anything mission-critical.
Talk to us
Start with the reference; it answers most of it. If you want to go further in your own environment, write to hello@provian.ai.